Merge branch 'claude/trust-connect-popup-56abec'

docs/manual-checks.md

@@ -74,10 +74,13 @@ pointer input matches a real mouse rather than a first look.
 
 Press Ctrl+K from the FILES screen and connect to a host whose key is not yet approved.
 
-**Pass:** the window lands on HOSTS with the fingerprint prompt visible and answerable.
+**Pass:** the fingerprint card comes up over the FILES screen, visible and answerable, and the screen
+underneath does not move — the transfer that was on it is still there when the question is answered.
+Approving connects; CANCEL leaves you on FILES.
 
 **Failure means:** the prompt is behind the screen that asked for it, and the connection is blocked on a
-question that cannot be reached.
+question that cannot be reached — or the window has jumped to HOSTS, which is what it used to do and what
+cost the palette its whole point.
 
 ### 1.6 The vault menu draws above the terminal's rectangle · **the one with a precedent**
 
@@ -814,8 +817,32 @@ would look.
 
 Connect to a host whose key is not yet approved.
 
-**Pass:** no tab is left behind, and the window is on HOSTS with the fingerprint prompt. Approving it
-connects and gives the tab a pane. This is 1.5 with the tab rework underneath it.
+**Pass:** no tab is left behind, and the fingerprint card is over whatever the window was showing. Approving
+it connects and gives the new tab a pane. This is 1.5 with the tab rework underneath it.
+
+### 7.4a A second connection's question, over a terminal that is open · **the occlusion one**
+
+With one terminal open and showing, connect to a *different* host whose key is not yet approved.
+
+**Pass:** the card is fully drawn and both its buttons take clicks. The terminal's rectangle is given up while
+it is up — the WebView is a native child window, so a card merely layered over it would be sliced at its left
+edge with TRUST AND CONNECT unreachable. Answering either way brings the pane back.
+
+**Failure means:** `IsTerminalShowing` has stopped asking `IsHostKeyDecisionShowing`, and the most
+safety-critical question in the product is half-drawn and unanswerable. No test can see this — headless
+Avalonia has no native child window.
+
+### 7.4b A changed host key can be got out of
+
+Connect to a host whose pin no longer matches (approve a key, then change it on the remote).
+
+**Pass:** the refusal is over the window with **no** way to continue — no "connect anyway", nothing that
+dismisses into a connection — and one control that puts it away. Pressing it leaves the screen that was
+underneath, and from there the host's editor and FORGET HOST KEY are reachable.
+
+**Failure means:** the refusal is stuck on screen. It was, until `RejectHostKey` started clearing the
+mismatch as well as the pending key: on the phone that left an opaque full-screen panel over every screen the
+user went to next, including the editor it tells them to open.
 
 ### 7.5 Giving up on a connection, and what arrives afterwards
 
@@ -1474,6 +1501,18 @@ colour, with no tab and nothing dialled.
 **Failure means:** for the suggestion strip, the box lost `Classes="secret"` — see 10.1, and it is the same
 seriousness here, since this password is typed rather than stored and so is typed often.
 
+### 11.7a A hand-typed machine's host key is judged on this screen · **the one the old arrangement got wrong**
+
+From Connections with nothing open, type a machine this keychain has never reached and press CONNECT.
+
+**Pass:** the UNKNOWN HOST KEY sheet rises **over this screen**. TRUST AND CONNECT opens the shell; CANCEL
+lowers the sheet and the box is still there, with what was typed still in it.
+
+**Failure means:** if the window is on HOSTS instead, the shell is navigating there before letting the
+handshake ask — which is what it used to do, and it is at its worst precisely here: a machine reached from
+this box is deliberately in no keychain, so it was being judged on a list it does not appear on, with the box
+that dialled it taken away. See `MainWindowViewModel.OnVaultConnectionFailed`.
+
 ### 11.8 A recent machine leads to the right place
 
 With at least one keychain host and one machine connected to by hand in the log, open Connections with